To: 


Of: 


ICO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Colour Car Sales Limited 


Unit 1 & 2 Mossfield Road, Stoke-on-Trent, England ST3 5BW 


The Information Commissioner (“the Commissioner”) has decided to 
issue Colour Car Sales Limited (“CCSL”) with a monetary penalty under 
section 55A of the Data Protection Act 1998 (“DPA”). The penalty is in 
relation to a serious contravention of Regulation 22 of the Privacy and 
Electronic Communications (EC Directive) Regulations 2003 (“PECR”). 


This notice explains the Commissioner’s decision. 


Legal framework 


CCSL, whose registered office is given above (Companies House 
Registration Number: 10382413) is the organisation stated in this 
notice to have instigated the transmission of unsolicited 
communications by means of electronic mail to individual subscribers 


for the purposes of direct marketing contrary to regulation 22 of PECR. 


Regulation 22 of PECR states: 
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“(1) This regulation applies to the transmission of unsolicited 


communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 


communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 
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Section 122(5) of the DPA18 defines direct marketing as “the 
communication (by whatever means) of any advertising material which 
is directed to particular individuals”. This definition also applies for the 


purposes of PECR (see regulation 2(2) PECR & Schedule 19 paragraphs 
430 & 432(6) DPA18). 


Prior to 29 March 2019, the European Directive 95/46/EC defined 
‘consent’ as “any freely given specific and informed indication of his 
wishes by which the data subject signifies his agreement to personal 


data relating to him being processed”. 


Consent in PECR is now defined, from 29 March 2019, by reference to 
the concept of consent in Regulation 2016/679 (“the GDPR”): 
regulation 8(2) of the Data Protection, Privacy and Electronic 
Communications (Amendments etc) (EU Exit) Regulations 2019. Article 
4(11) of the GDPR sets out the following definition: “'consent’ of the 
data subject means any freely given, specific, informed and 
unambiguous indication of the data subject's wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her”. 


Recital 32 of the GDPR materially states that “When the processing has 
multiple purposes, consent should be given for all of them”. Recital 42 
materially provides that “For consent to be informed, the data subject 
should be aware at least of the identity of the controller”. Recital 43 
materially states that “Consent is presumed not to be freely given if it 
does not allow separate consent to be given to different personal data 
processing operations despite it being appropriate in the individual 


case”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 
and includes an unincorporated body of such individuals”. 
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A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 


a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


“Electronic mail’ is defined in regulation 2(1) of PECR as “any text, 
voice, sound or image message sent over a public electronic 
communications network which can be stored in the network or in the 
recipient’s terminal equipment until it is collected by the recipient and 


includes messages sent using a short message service”. 


The term "soft opt-in" is used to describe the rule set out in in 
Regulation 22(3) of PECR. In essence, an organisation may be able to 
e-mail its existing customers even if they haven't specifically consented 
to electronic mail. The soft opt-in rule can only be relied upon by the 
organisation that collected the contact details. 


Section 55A of the DPA (as amended by the Privacy and Electronic 
Communications (EC Directive)(Amendment) Regulations 2011 and the 
Privacy and Electronic Communications (Amendment) Regulations 
2015) states: 


“1) The Commissioner may serve a person with a monetary penalty if 


the Commissioner is satisfied that - 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 


Directive) Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 


(3) This subsection applies if the person - 
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(a) knew or ought to have known that there was a risk that the 


contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention. ” 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 
overall aim of ensuring high levels of protection for individuals’ privacy 
rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


Background to the case 


Phone users can report the receipt of unsolicited marketing text 
messages to the GSMA’s Spam Reporting Service by forwarding the 
message to 7726 (spelling out “SPAM”). The GSMA is an organisation 
that represents the interests of mobile operators worldwide. The 


Commissioner is provided with access to the data on complaints made 
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to the 7726 service and this data is incorporated into a Monthly Threat 


Assessment (MTA) used to ascertain organisations in breach of PECR. 


CCSL are a company that act as a credit intermediary for finance on 
used cars. They are understood to have previously operated through 
several websites, including ‘Immediatecarfinance.co.uk’, 


‘carfinancetoday.net’ and ‘achillesuk.co.uk’. 


CCSL are authorised by the Financial Conduct Authority (“FCA”) to 
conduct regulated financial activities. They are registered with the FCA 
to conduct credit broking, debt adjustment, debt-counselling and 
providing credit information services. Five trading names are 
registered with the FCA - ‘Colour Car Sales Limited’, ‘Carfinancetoday’, 
‘Carfinancetoday.net’, ‘Comapare The Lease’ [sic] and ‘Compare the 


Finance’. 


Between 1 October 2018 and 26 September 2019, 34 complaints were 
received via the ICO Online Reporting Tool (“OLRT”), with a further 144 
complaints being made via the 7726 service regarding unsolicited 
electronic direct marketing text messages driving people to one of the 


sites known to be operated by CCSL. 


An initial investigation letter was sent to CCSL’s registered office 
address on 14 October 2019 setting out the Commissioner’s concerns 
regarding CCSL’s compliance with PECR, providing details of the 
complaints that had been received, and asking for details as to its 
practices and direct marketing campaign. This letter was returned as 
undelivered on 24 October 2019 and so the Commissioner contacted 
the listed company Director by telephone using the FCA registered 
number for him. A copy of the Commissioner’s initial investigation 


letter was subsequently emailed to an address which was provided, 
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which also appeared to be the email address for the company as 
registered with the FCA. 


Having received no response, the Commissioner contacted the 
company director by telephone on 20 January 2020 who advised that 
the Commissioner’s initial investigation letter had not been received. 
An alternative email address was provided, together with an alternative 


mailing address. 


In the intervening period since the initial investigation letter was first 
sent, the Commissioner had become aware that there had been a 
number of further complaints about unsolicited direct marketing 
messages sent on behalf of CCSL being received by individuals. The 
initial investigation letter was therefore resent to the newly provided 
email and postal addresses, together with an updated appendix 
containing the up-to-date complaints figures, on 22 January 2020. 


A response to the initial investigation letter was received on 27 
February 2020. CCSL explained that it used a platform called ‘Text 
Local’ to send messages to subscribers. CCSL sourced its data from 
individuals who had made an “application for finance” on its website 
and advised that the number of messages an individual would be sent 
would depend on the age of their application, with a total of forty-two 


possible messages being sent to an applicant over a four-year period. 


CCSL stated that between 1 October 2018 and 14 October 2019 it had 


sent a total of 3,001,385 direct marketing messages to subscribers. 


In response to the Commissioner’s question about how it obtains 
consent, CCSL explained that there is a notice below the application 
form on its website which states that by submitting an application they 
agree to being contacted by CCSL or a third party by post, phone, 
email or SMS. 
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The Commissioner examined one of CCSL’s websites, 
‘Immediatecarfinance.co.uk’, and located the statement referred to, 


noting that it stated: 


“By starting an application you agree that immediatecarfinance 
may/will pass your details on to a third party lender or broker, 
and they may wish to contact you by phone, post, SMS or other 
electronic means” 

The Commissioner found an equivalent statement to be present on the 


other CCSL landing pages for ‘AchillesUK’ and ‘Carfinancetoday.net’. 


There was no specific reference to direct marketing within this 
statement, or indeed any indication of the purpose of the contact from 
these unnamed third parties. Furthermore, it did not appear possible 
for an individual to select who they may or may not wish to be 
contacted by; to specify which, if any, of the methods proposed they 
may wish to be contacted by; or to proceed with their application 
without agreeing to this statement. It is the Commissioner’s 
understanding that CCSL used the data obtained at this point on its 
various websites to carry out its subsequent direct marketing 
campaigns, but notes that individuals were not able to refuse the use 


of their contact details for such direct marketing. 


CCSL explained that in order to opt-out of receiving SMS messages an 
individual would need to either call the office to opt-out, or call the 


office and fully close down their finance application. 


It also claimed that: “Out of 3,001,385 text messages sent over the 
year, only 27 INDIVIDUAL PEOPLE have lodged a complaint [with the 


Commissioner] of which 10 have complained multiple times”. 
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The Commissioner reviewed the ‘immediatecarfinance.co.uk’ privacy 
policy, which frequently referred to itself as ‘carfinancetoday.net’, and 
noted that under the section headed ‘How do you use my personal 
information for marketing?’ it states “We can only use your personal 
information to send you marketing communications if we have either 


your consent, or a ‘legitimate business interest”. 


The Commissioner sent further enquiries to CCSL on 6 March 2020, 
requesting inter alia copies of the text messages sent to individuals, 
and details of CCSL’s relationship with i The 
Commissioner had noted that I / HM bad been 
named in a number of the complaints that had been received and 
noted that the company director for CCSL appeared to have a 


connection to i on LinkedIn. The Commissioner 


wished to know more about the link between the two entities. 


Despite three chaser emails on 16 March 2020, 19 May 2020, and 12 
October 2020, CCSL failed to provide any response to the 
Commissioner’s further queries. CCSL did not engage with the 


Commissioner again for the duration of the investigation. 


On 7 October 2020 the Commissioner sent a third-party information 
notice (“3PIN”) to CCSL’s text message platform, TxtLocal Ltd t/a Text 
Local (“Text Local”). This 3PIN advised that the Commissioner was 
aware that CCSL held a Text Local account and would send messages 
containing the URL ‘immediatecarfinance.co.uk’. The Commissioner 
requested contact details for that account, and requested details of the 
volumes of messages sent, the number of those messages which had 
been received by a subscriber, and copies of the content of those 


messages. 
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The Commissioner received a response to the 3PIN indicating that the 

account was registered in the personal name of CCSL’s company 

Director, but in the company name of O The 

response also provided an Excel Spreadsheet which showed that large 

quantity of messages had been sent from this account which made 

specific reference to ‘immediatecarfinance.co.uk’; 

‘carfinancetoday.net’; ‘achillesuk.com’; ‘taxifinancetoday.com’, or 

contained one of two CLIs which had been explicitly provided in all of 

the messages directing individuals to ‘immediatecarfinance.co.uk’. 

These were known trading names of CCSL. The Commissioner was 

able to establish that during the period 1 October 2018 to 7 January 

2020, a total of 3,650,194 messages had been sent which expressly 

cited these trading names/CLIs. It was not possible to determine how 

many of those messages were subsequently received as that data was 

not retained. 


The Commissioner was able to compile a full appendix of the 
complaints for the messages sent at the instigation of CCSL and 
concluded that there were 228 complaints made via the 7726 service 
and 46 complaints made to the OLRT between 1 October 2018 and 21 
January 2020. 


Given CCSL’s lack of engagement with the Commissioner since 27 
February 2020, the decision was taken to send an ‘end of investigation’ 
letter to CCSL on 19 October 2020. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute 
a contravention of regulation 22 of PECR by CCSL and, if so, whether 
the conditions of section 55A DPA are satisfied. 
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The contravention 
The Commissioner finds that CCSL contravened regulation 22 of PECR. 
The Commissioner finds that the contravention was as follows: 


The Commissioner finds that between 1 October 2018 and 21 January 
2020 there were 274 direct marketing text messages received by 
subscribers which are capable of being evidenced by complaints. The 
Commissioner finds that CCSL instigated the transmission of the direct 


marketing messages sent, contrary to regulation 22 of PECR. 


The Commissioner is not assisted by CCSL’s failure to engage with her 
during this investigation to explain the relationship between CCSL and 


Eee However she is satisfied that for the purposes 
of the direct marketing messages sent fro m 


Text Local account, CCSL positively encouraged the sending of those 
messages. She makes this finding in light of the information provided 
by Text Local in response to the Commissioner’s 3PIN, and in view of 
the content of the unsolicited direct marketing messages sent which 


resulted in 274 complaints. 


CCSL, as the instigator of the direct marketing, is required to ensure 
that it is acting in compliance with the requirements of regulation 22 of 
PECR, and to ensure that valid consent to send those messages had 


been acquired. 


In this instance, individuals applying for finance via one of CCSL’s sites 
were given no option but to agree to receive direct marketing from 
CCSL and its unnamed third parties. Indeed, the statement that would 


accompany the applications did not indicate in any manner that the 


11 


47. 


48. 


49. 


50. 


© 

1C O © 

Information Commissioner's Office 
individual’s personal details would be used for direct marketing 
purposes. Furthermore, individuals could not specify the type of direct 
marketing that they might be willing to receive, rather they were 


required to agree to a suite of contact methods, from an unknown 


number of third parties. 


For consent to be valid it is required to be “freely given”, by which it 
follows that if consent to marketing is a condition of subscribing to a 
service, the organisation will have to demonstrate how the consent can 
be said to have been given freely. In this instance, CCSL has failed to 


explain how its consent could be said to be freely given. 


Consent is also required to be “specific” as to the type of marketing 
communication to be received, and the organisation, or specific type of 
organisation, that will be sending it. Again, this requirement does not 


appear to be met in CCSL’s case. 


Consent will not be “informed” if individuals do not understand what 
they are consenting to. Organisations should therefore always ensure 
that the language used is clear, easy to understand, and not hidden 
away in a privacy policy or small print. Consent will not be valid if 
individuals are asked to agree to receive marketing from “similar 
organisations”, “partners”, “selected third parties” or other similar 


generic description. 


The Commissioner is satisfied that CCSL cannot avail itself to the “soft 
opt-in” exemption provided by regulation 22(3) PECR. This exemption 
means that organisations can send marketing messages by text and e- 
mail to individuals whose details had been obtained in the course or 
negotiation of a sale and in respect of similar products and services. 
The organisation must also give the person a simple opportunity to 


refuse or opt out of the marketing, both when first collecting the details 
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and in every message after that. It is apparent from the sign-up page 
on CCSL’s websites that individuals were not provided a simple 
opportunity to refuse or opt out of the marketing, nor were they 
offered an opt-out in the subsequent direct marketing messages that 


they received. The Commissioner therefore finds that CCSL is unable to 


rely on this exemption. 


The Commissioner is satisfied that this contravention could have been 
far greater, since there is evidence that a total of 3,650,194 direct 
marketing messages were sent to individuals at the instigation of CCSL 
over the contravention period. However, because of CCSL’s lack of 
engagement, and the Communications Service Provider's failure to 
retain such records, it has not been possible to determine the exact 
number of those messages which were received by subscribers. The 


full extent of the contravention is therefore unknown. 


The Commissioner is satisfied from the evidence she has seen that 
CCSL did not have the necessary valid consent for the 274 direct 


marketing messages received by subscribers. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because between 1 October 2018 and 21 
January 2020, a confirmed total of 274 direct marketing messages 
were sent at the instigation of CCSL. These messages contained direct 
marketing material for which subscribers had not provided valid 


consent. 
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The Commissioner takes the view that the serious nature of the 
contravention extends wider than the number of complaints. In 
particular, the Commissioner has regard to the significant number of 
3,650,194 direct marketing messages sent over the period of 


contravention, for which CCSL has made no attempt to evidence 


consent. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A(1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 


above was deliberate. 


The Commissioner considers that in this case CCSL did deliberately 
contravene regulation 22 of PECR. In the Commissioner's view, this 
means that CCSL’s actions which constituted that contravention were 
deliberate actions (even if CCSL did not actually intend thereby to 
contravene PECR). This finding is made on the basis that CCSL chose to 
instigate the sending of direct marketing material to individuals without 
providing a simple means of opting out of such marketing, or allowing 
individuals an option to consent to direct marketing at all. 

Furthermore, the Commissioner is concerned that CCSL do not appear 
to have had any policies or procedures in place relating to PECR 


whatsoever. 
Further and in the alternative, the Commissioner has gone on to 


consider whether the contravention identified above was negligent. 


This consideration comprises two elements: 
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Firstly, she has considered whether CCSL knew or ought reasonably to 
have known that there was a risk that these contraventions would 
occur. She is satisfied that this condition is met, not least since the 


issue of unsolicited text messages has been widely publicised by the 


media as being a problem. 


The Commissioner has published detailed guidance for those carrying 
out direct marketing explaining their legal obligations under PECR. 

This guidance gives clear advice regarding the requirements of consent 
for direct marketing and explains the circumstances under which 
organisations are able to carry out marketing over the phone, by text, 
by email, by post, or by fax. In particular it states that organisations 
can generally only send, or instigate, marketing messages to 
individuals if that person has specifically consented to receiving them. 
The guidance also provides a full explanation of the “soft opt-in” 
exemption. There is no indication that CCSL had given any regard to 


this guidance prior to the contravention 


It is therefore reasonable to suppose that CCSL should have been 


aware of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether CCSL 
failed to take reasonable steps to prevent the contraventions. Again, 


she is satisfied that this condition is met. 


In particular, the Commissioner considers that any person wishing to 
engage in direct marketing by text message could and should - 
particularly since the coming into effect of the GDPR - have ensured 
that all of their consent capture mechanism properly enabled consent 
to be separately given or withheld for direct marketing 


communications, and that the privacy information provided was specific 
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and clear as to what sort of communications would be sent and for 
what purpose. CCSL did not do this. 


CCSL, during its brief engagement at the outset of the investigation, 
has failed to provide any evidence of any policies or procedures relating 
to PECR, or indeed of any relevant data protection training being given 


to employees at all. 


Furthermore, CCSL could legitimately have sought advice either from 
the Commissioner or from an independent legal advisor in relation to 
the basis on which it proposed to send its unsolicited direct marketing, 


however there is no evidence that CCSL sought to do this. 


In the circumstances, the Commissioner is satisfied that CCSL failed to 


take reasonable steps to prevent the contraventions. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner's decision to issue a monetary penalty 


The Commissioner has also taken into account the following 


aggravating features of this case: 


CCSL acted seemingly without any regard for PECR in an effort to 


unlawfully generate income and profit; 


In addition to the Commissioner’s readily available guidance, the 
Commissioner noted that CCSL held a membership with the FCA and as 
such would have been exposed to additional guidance in respect of their 


legal requirements including compliance with PECR legislation; 
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The Commissioner notes that CCSL failed to cooperate with the 
investigation. CCSL’s registration with the ICO was out of date, and 
notification details were not updated. It was also uncovered that CCSL’s 
Companies House details were not kept up to date. The Commissioner 


views this factor as an indication that CCSL were being purposefully 


evasive; 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking. The Commissioner sent 
the Notice of Intent by first class post to CCSL’s registered office 
address on 6 April 2021 and, having received no response, sent a 
follow-up email and further copy of the Commissioner's preliminary 
Notices to the only email address which had provided a response 
during the Commissioner’s investigation - 
en — 0 6 May 2021. CCSL has not 
acknowledged receipt and did not provide any representations in 


response to the Notice of Intent. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty. 


The Commissioner has attempted to consider the likely impact of a 


monetary penalty on CCSL but has been unable to do so given the lack 
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of recent publicly available information. CCSL was invited to provide 
financial representations in response to the Notice of Intent but failed 


to do so. The Commissioner considers in the circumstances that a 


penalty remains the appropriate course of action. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The sending of 
unsolicited direct marketing messages is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. The issuing of a 
monetary penalty will reinforce the need for businesses to ensure that 
they are only messaging those who specifically consent to receive 
marketing. 


For these reasons, the Commissioner has decided to issue a monetary 
penalty in this case. 


The amount of the penalty 


77. 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £170,000 (one hundred and seventy 
pounds) is reasonable and proportionate given the particular facts of 


the case and the underlying objective in imposing the penalty. 


Conclusion 


78. 


Taking monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 24 June 2021 at the latest. The monetary 


penalty is not kept by the Commissioner but will be paid into the 
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Consolidated Fund which is the Government’s general bank account at 
the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
23 June 2021 the Commissioner will reduce the monetary penalty by 
20% to £136,000 (one hundred and thirty-six thousand 
pounds). However, you should be aware that the early payment 


discount is not available if you decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 
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e the period for appealing against the monetary penalty and any 


variation of it has expired. 


84. In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 24t" day of May 2021 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that she ought to have exercised 


her discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 
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Telephone: 0300 123 4504 
Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state: - 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you; 

c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the 


notice of appeal must include a request for an extension of time 


22 


Information Commissioner's Office 


and the reason why the notice of appeal was not provided in 


time. 


5. Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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